RustVEHSyscalls - A Rust port of LayeredSyscall — performs indirect

项目说明

Rust

Rust is a Rust-based port of the LayeredSyscall project. This tool performs indirect syscalls while generating legitimate API call stack frames by abusing Exception Handling (VEH) to bypass user-land EDR hooks in Windows.

How It Works

Rust performs indirect syscalls by abusing Exception Handling (VEH) to generate legitimate API call stack frames. By calling a standard Windows API function and setting a hardware breakpoint within it, the function's call stack is captured. This breakpoint then lets the process to a syscall wrapper in ntdll.dll, preserving the original API's call stack structure. This approach enables syscalls to appear as if they originate from legitimate Windows API calls.

Setup and Cleanup Functions

Rust provides functions to initialize and clean up the Exception Handling en necessary for syscall interception. These functions establish the hooks needed to capture and handle indirect syscalls, ensuring clean operation and teardown.

1. initialize_hooks():
- Sets up two exception handlers for adding and managing hardware breakpoints in the system call path. This function allocates memory for the CPU context and retrieves ntdll.dll's base and end addresses for tracing purposes.
2. destroy_hooks():
- Cleans up by removing the added exception handlers.

Syscall Wrapper

Rust provides a syscall! macro that wraps several key steps:

1. Resolving the Syscall Address and SSN: The macro uses the PEB to locate ntdll.dll and parses its Exception Directory and Export Address Table to retrieve both the syscall’s address and System Service Number (SSN).
2. Setting Hardware Breakpoint: Once the syscall address and SSN are resolved, the macro sets a hardware breakpoint, allowing Rust to intercept the syscall execution.
3. In the Syscall: Finally, the macro invokes the syscall with the specified parameters, completing the indirect syscall path.

Usage

To initialize syscall interception, call initialize_hooks() at the start of your main function and destroy_hooks() to clean up once you're done. You can also adjust the legitimate call stack by modifying the demofunction() in the hooks.rs module.

Example: Calling NtCreateUserProcess

The following example demonstrates how to invoke the NtCreateUserProcess syscall. Full test code is a in lib.rs.

Disclaimer

This project is intended for educational and research purposes only. Use it responsibly, as any misuse is solely your responsibility—not mine! Always follow ethical guidelines and legal frameworks when doing security research (and, you know, just in general).

Credits

Special thanks to:

Contributing

Contributions are welcome! If you want to help improve Rust or report bugs, feel free to open an issue or a pull request in the repository.

---

项目信息

开发语言：Rust

Star 数：166

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Rust port of LayeredSyscall — performs indirect syscalls while generating legitimate API call stack frames by abusing VEH.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。